ASD ISM 0459 Implement full or partial disk encryption
What it says
Full disk encryption, or partial encryption where access controls only allow writing to encrypted partitions or volumes, is implemented when encrypting media.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse full disk encryption when encrypting media, or partial encryption where access controls only allow writes to encrypted partitions or volumes.
This control ensures that when you encrypt media (computer hard drives, and removable media such as USB and external drives), either the whole drive is encrypted, or only part of it is encrypted but access controls stop anyone writing data anywhere except the encrypted partitions or volumes. Encryption means the data is scrambled in a way that only someone with the right password can unscramble and read it. This is important because if a device or drive gets lost or stolen, without encryption, anyone could access sensitive information stored on it.
Free. Save your status, tasks and notes.
Why it matters
If not encrypted, lost or stolen devices can lead to data breaches, exposing confidential information and harming business reputation.
How to implement
IT Team: Ensure full or partial disk encryption is enabled on all computers and servers.
Use built-in tools like BitLocker for Windows or FileVault for Mac to encrypt data on disks.
IT Team: Where only part of a drive is encrypted, configure access controls (for example, file system permissions or write-protection on the unencrypted partition) so that data can only be written to the encrypted partitions or volumes.
System Administrator: Regularly check that encryption is active on all devices by reviewing system settings.
This can often be found under 'Security' or 'System Preferences'.
IT Team: Encrypt removable media such as USB and external drives before use, for example with BitLocker To Go or FileVault, so the same full or partial encryption rule applies to all media.
Office Manager: Confirm with the IT team that new computers and tablets have disk encryption enabled before they are issued to staff.
Keep it running
Regularly verify that encryption is active on all devices and media, and where partial encryption is used, that access controls still only allow writes to encrypted partitions or volumes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for a list of all devices and media that are encrypted, showing whether full disk encryption or partial encryption is used.
Look at
Check that each device, especially those that store sensitive information, is included in the list.
Good evidence
Every in-scope device appears on the list with full disk encryption, or partial encryption where write access is limited to encrypted partitions or volumes.
- Check 2 of 5What an auditor asks for
Ask for
Request records of regular audits of encrypted systems.
Look at
Look at the dates and findings from these audits to confirm encryption is consistently checked.
Good evidence
Audits occur on a regular cycle and findings are recorded.
- Check 3 of 5What an auditor asks for
Ask for
Ask for new device onboarding records.
Look at
Check that encryption is included as a standard step in the setup procedure.
Good evidence
A completed onboarding checklist exists for each device with the encryption step included.
- Check 4 of 5What an auditor asks for
Ask for
For any media using partial encryption, ask for the access control configuration that restricts where data can be written.
Look at
Check that the configuration only allows writes to the encrypted partitions or volumes and blocks writes to unencrypted areas.
Good evidence
Access controls are configured so that data can only be written to encrypted partitions or volumes, and this is confirmed on a sample of devices.
- Check 5 of 5What an auditor asks for
Ask for
Ask how removable media such as USB and external drives are encrypted.
Look at
Check that removable media is covered by the same full or partial encryption approach as fixed drives.
Good evidence
Removable media is encrypted before use, with full encryption or partial encryption where writes are limited to encrypted partitions or volumes.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-0459 requires implementing full disk encryption, or partial disk encryption where controls ensure data can only be written to the encrypted partition, to protect data at rest on storage media. This is a direct instance of cryptography use: disk/volume encryption is a concrete application of cryptographic controls and depends on appropriate key handling to prevent offline access to data if a device or drive is lost, stolen, or removed. Annex A 8.24 is broader because it requires the organisation to define and implement rules for cryptography and cryptographic key management across all relevant use cases (not only disks), whereas ISM-0459 focuses specifically on encryption-at-rest for disks/partitions and the write-to-encrypted-partition condition.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.